Integer Overflow Vulnerability in libssh2 Affects SSH Connections
CVE-2019-17498
8.1HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2019-17498?
An integer overflow vulnerability exists in the SSH_MSG_DISCONNECT logic within libssh2. An attacker can exploit this weakness by crafting an SSH server that sends specially crafted packets with out-of-bounds offsets for memory reads. This can lead to the disclosure of sensitive information or potentially cause a denial of service condition for client systems connecting to the malicious server. The issue is identified in versions of libssh2 up to and including v1.9.0.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.